RoleBindings

RoleBindings are a namespace-scoped resource in Kubernetes RBAC that grant the permissions defined in a Role or ClusterRole to a set of subjects within a specific namespace. They connect a role’s rules to identities such as users, groups, or service accounts, enabling those identities to perform the actions allowed by the role in that namespace.

A RoleBinding references a roleRef, which can point to either a Role (within the same namespace) or a ClusterRole (which can provide permissions across namespaces when bound in a given namespace). The effective permissions come from the rules of the referenced Role or ClusterRole. RoleBindings are distinct from ClusterRoleBindings, which bind ClusterRoles to subjects across the entire cluster; RoleBindings are limited to their own namespace.

Subjects in a RoleBinding specify who receives the permissions. Each subject has a kind, such as User, Group, or ServiceAccount. The subject’s name identifies the identity, and if the subject is a ServiceAccount, a namespace must be specified to locate the account. For User or Group subjects, no namespace is associated with the subject.

RoleBindings are commonly used to grant specific users, groups, or service accounts access to resources within a namespace, according to the permissions defined in a Role or ClusterRole. They are evaluated by the API server as part of the RBAC authorization process, alongside any applicable ClusterRoleBindings, to determine whether a particular action is allowed.